CVE-2018-0131 - CVE House

Back to Database

Status published Medium CVE-2018-0131

A vulnerability in the implementation of RSA-encrypted nonces in Cisco...

5.9 CVSS

Vulnerability Description

A vulnerability in the implementation of RSA-encrypted nonces in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to obtain the encrypted nonces of an Internet Key Exchange Version 1 (IKEv1) session. The vulnerability exists because the affected software responds incorrectly to decryption failures. An attacker could exploit this vulnerability sending crafted ciphertexts to a device configured with IKEv1 that uses RSA-encrypted nonces. A successful exploit could allow the attacker to obtain the encrypted nonces. Cisco Bug IDs: CSCve77140.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-0131

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Cisco Systems, Inc.

View All →

Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc....

An exploitable code execution vulnerability exists in the XCF image...

An exploitable information vulnerability exists in the XCF image rendering...

An exploitable information disclosure vulnerability exists in the PCX image...

A vulnerability in the account management subsystem of Cisco Web...

Affected Vendor

Cisco Systems, Inc.

View all reports →

Affected Software

IOS and IOS XE

Vulnerable Versions:

unspecified

Timeline

Official Publish: August 14th, 2018

Last Modified: November 26th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.